"KOBOLD 2" (5-June-1990)
Entry............... "Kobold 2" Virus
Alias............... ---
Strain.............. ---
Detected when....... ---
         where...... Utrecht (Netherlands)
Classification...... System (Boot sector) Virus, Reset-resident
Length of virus..... 512 Bytes
------------------------Preconditions----------------------------------
Operating System(s). Atari TOS
Version\Release..... TOS 1.0 and 1.2
Computer models..... Atari ST 
-------------------------Attributes------------------------------------
Easy identification. If the boot sector is infected, the string
                     'KOBOLD#2 AKTIV!' can be found in the middle of the
                     boot sector; in memory, this string can be found
                     at beginning of transient programm area (TPA).
Type of infection... Any boot sector that can be written to.
Infection trigger... Execution of XBIOS disk functions.
                     Execution of boot code.
Media affected...... Drive which is set as boot device or accessed by 
                     XBIOS.
Interrupts hooked... Vertical Blank Interrupt at infection time;
                     hdv_bpb (harddisk bios parameter block);
                     resetvector.
Damage.............: Permanent Damage: Overwriting Bootsectors.
                     Transient Damage: Speeding up mouse motion 
                         in directions UP and LEFT. 
Damage trigger.....: Internal counter 
Particularities..... With TOS 1.2, mouse motion is not changed.
Similarities........ ---
Countermeasures..... Make sure that the virus is not in memory.
                     Search boot sector for string mentioned above.
                     Modify last byte in boot sector to other value.
Standard means...... Clear all bytes in boot sector beginning at
                     offset 30 decimal.
-----------------------Acknowledgements--------------------------------
Location............ Virus Test Center, University of Hamburg FRG
Classifcation by.... Thomas Piehl
Documentation by.... Thomas Piehl
Information Source.. George R. Woodside
Date................ 5-June-1990

.